From ef38ecec83a68e3bb0805e4991ef58d98b008605 Mon Sep 17 00:00:00 2001 From: mhoellein Date: Tue, 24 Sep 2019 11:25:48 +0200 Subject: [PATCH] committing changes in /etc after apt run Package changes: +fail2ban 0.10.2-2 all --- .etckeeper | 24 ++- bash_completion.d/fail2ban | 182 ++++++++++++++++++ default/fail2ban | 39 ++++ fail2ban/action.d/abuseipdb.conf | 105 ++++++++++ fail2ban/action.d/badips.py | 23 ++- fail2ban/action.d/bsd-ipfw.conf | 10 +- fail2ban/action.d/cloudflare.conf | 14 +- fail2ban/action.d/complain.conf | 35 +++- fail2ban/action.d/dshield.conf | 3 + fail2ban/action.d/dummy.conf | 26 ++- fail2ban/action.d/firewallcmd-allports.conf | 28 +-- fail2ban/action.d/firewallcmd-common.conf | 76 ++++++++ fail2ban/action.d/firewallcmd-ipset.conf | 43 ++++- fail2ban/action.d/firewallcmd-multiport.conf | 57 +----- fail2ban/action.d/firewallcmd-new.conf | 29 +-- .../action.d/firewallcmd-rich-logging.conf | 51 +++++ fail2ban/action.d/firewallcmd-rich-rules.conf | 42 ++++ fail2ban/action.d/helpers-common.conf | 16 ++ fail2ban/action.d/hostsdeny.conf | 5 +- fail2ban/action.d/iptables-allports.conf | 2 +- fail2ban/action.d/iptables-common.conf | 28 +++ fail2ban/action.d/iptables-ipset-proto4.conf | 9 +- .../iptables-ipset-proto6-allports.conf | 32 ++- fail2ban/action.d/iptables-ipset-proto6.conf | 32 ++- fail2ban/action.d/iptables-multiport-log.conf | 10 +- fail2ban/action.d/iptables-multiport.conf | 2 +- fail2ban/action.d/iptables-new.conf | 2 +- .../action.d/iptables-xt_recent-echo.conf | 30 ++- fail2ban/action.d/iptables.conf | 2 +- fail2ban/action.d/mail-buffered.conf | 9 +- fail2ban/action.d/mail-whois-lines.conf | 33 +++- fail2ban/action.d/mail-whois.conf | 9 +- fail2ban/action.d/mail.conf | 9 +- fail2ban/action.d/netscaler.conf | 33 ++++ fail2ban/action.d/nftables-allports.conf | 2 +- fail2ban/action.d/nftables-common.conf | 30 ++- fail2ban/action.d/nginx-block-map.conf | 108 +++++++++++ fail2ban/action.d/npf.conf | 61 ++++++ fail2ban/action.d/pf.conf | 78 +++++++- fail2ban/action.d/sendmail-buffered.conf | 11 +- fail2ban/action.d/sendmail-common.conf | 4 +- fail2ban/action.d/sendmail-geoip-lines.conf | 18 +- .../sendmail-whois-ipjailmatches.conf | 5 +- .../action.d/sendmail-whois-ipmatches.conf | 5 +- fail2ban/action.d/sendmail-whois-lines.conf | 16 +- fail2ban/action.d/sendmail-whois-matches.conf | 5 +- fail2ban/action.d/sendmail-whois.conf | 5 +- fail2ban/action.d/sendmail.conf | 5 +- fail2ban/action.d/shorewall.conf | 18 +- fail2ban/action.d/smtp.py | 7 +- fail2ban/action.d/xarf-login-attack.conf | 13 +- fail2ban/fail2ban.conf | 4 +- fail2ban/filter.d/3proxy.conf | 2 + fail2ban/filter.d/apache-auth.conf | 40 ++-- fail2ban/filter.d/apache-badbots.conf | 5 +- fail2ban/filter.d/apache-botsearch.conf | 13 +- fail2ban/filter.d/apache-common.conf | 23 ++- fail2ban/filter.d/apache-fakegooglebot.conf | 2 + fail2ban/filter.d/apache-modsecurity.conf | 3 +- fail2ban/filter.d/apache-overflows.conf | 6 +- fail2ban/filter.d/apache-pass.conf | 7 +- fail2ban/filter.d/apache-shellshock.conf | 8 +- fail2ban/filter.d/assp.conf | 36 +++- fail2ban/filter.d/asterisk.conf | 29 +-- fail2ban/filter.d/botsearch-common.conf | 2 +- fail2ban/filter.d/common.conf | 13 +- fail2ban/filter.d/counter-strike.conf | 2 - fail2ban/filter.d/courier-auth.conf | 4 +- fail2ban/filter.d/courier-smtp.conf | 6 +- fail2ban/filter.d/cyrus-imap.conf | 2 +- fail2ban/filter.d/directadmin.conf | 1 - fail2ban/filter.d/domino-smtp.conf | 47 +++++ fail2ban/filter.d/dovecot.conf | 37 +++- fail2ban/filter.d/dropbear.conf | 8 +- fail2ban/filter.d/ejabberd-auth.conf | 11 +- fail2ban/filter.d/exim-common.conf | 6 +- fail2ban/filter.d/exim.conf | 30 ++- fail2ban/filter.d/freeswitch.conf | 19 +- fail2ban/filter.d/froxlor-auth.conf | 7 +- fail2ban/filter.d/guacamole.conf | 5 +- fail2ban/filter.d/haproxy-http-auth.conf | 2 +- .../ignorecommands/apache-fakegooglebot | 29 +-- fail2ban/filter.d/kerio.conf | 10 +- fail2ban/filter.d/lighttpd-auth.conf | 2 +- fail2ban/filter.d/mongodb-auth.conf | 49 +++++ fail2ban/filter.d/monit.conf | 15 +- fail2ban/filter.d/murmur.conf | 9 +- fail2ban/filter.d/mysqld-auth.conf | 2 +- fail2ban/filter.d/named-refused.conf | 8 +- fail2ban/filter.d/nginx-botsearch.conf | 3 + fail2ban/filter.d/nginx-http-auth.conf | 4 +- fail2ban/filter.d/nginx-limit-req.conf | 5 +- fail2ban/filter.d/nsd.conf | 7 +- fail2ban/filter.d/openhab.conf | 1 - fail2ban/filter.d/oracleims.conf | 4 +- fail2ban/filter.d/pam-generic.conf | 7 +- fail2ban/filter.d/php-url-fopen.conf | 3 + fail2ban/filter.d/phpmyadmin-syslog.conf | 18 ++ fail2ban/filter.d/portsentry.conf | 3 + fail2ban/filter.d/postfix.conf | 60 +++++- fail2ban/filter.d/proftpd.conf | 15 +- fail2ban/filter.d/pure-ftpd.conf | 4 + fail2ban/filter.d/roundcube-auth.conf | 9 +- fail2ban/filter.d/selinux-common.conf | 2 + fail2ban/filter.d/sendmail-auth.conf | 4 +- fail2ban/filter.d/sendmail-reject.conf | 48 +++-- fail2ban/filter.d/slapd.conf | 25 +++ fail2ban/filter.d/sogo-auth.conf | 7 +- fail2ban/filter.d/squid.conf | 3 + fail2ban/filter.d/squirrelmail.conf | 2 - fail2ban/filter.d/sshd.conf | 97 +++++++--- fail2ban/filter.d/suhosin.conf | 2 +- fail2ban/filter.d/tine20.conf | 15 +- fail2ban/filter.d/vsftpd.conf | 2 +- fail2ban/filter.d/xinetd-fail.conf | 6 +- fail2ban/filter.d/zoneminder.conf | 21 ++ fail2ban/jail.conf | 133 +++++++++---- fail2ban/jail.d/defaults-debian.conf | 2 + fail2ban/paths-arch.conf | 32 +++ fail2ban/paths-common.conf | 38 ++-- fail2ban/paths-debian.conf | 15 +- fail2ban/paths-opensuse.conf | 24 +-- init.d/fail2ban | 4 +- logrotate.d/fail2ban | 17 ++ monit/monitrc.d/fail2ban | 9 + rc0.d/K01fail2ban | 1 + rc1.d/K01fail2ban | 1 + rc2.d/S05fail2ban | 1 + rc3.d/S05fail2ban | 1 + rc4.d/S05fail2ban | 1 + rc5.d/S05fail2ban | 1 + rc6.d/K01fail2ban | 1 + .../multi-user.target.wants/fail2ban.service | 1 + 133 files changed, 2116 insertions(+), 488 deletions(-) create mode 100644 bash_completion.d/fail2ban create mode 100644 default/fail2ban create mode 100644 fail2ban/action.d/abuseipdb.conf create mode 100644 fail2ban/action.d/firewallcmd-common.conf create mode 100644 fail2ban/action.d/firewallcmd-rich-logging.conf create mode 100644 fail2ban/action.d/firewallcmd-rich-rules.conf create mode 100644 fail2ban/action.d/helpers-common.conf create mode 100644 fail2ban/action.d/netscaler.conf create mode 100644 fail2ban/action.d/nginx-block-map.conf create mode 100644 fail2ban/action.d/npf.conf create mode 100644 fail2ban/filter.d/domino-smtp.conf create mode 100644 fail2ban/filter.d/mongodb-auth.conf create mode 100644 fail2ban/filter.d/phpmyadmin-syslog.conf create mode 100644 fail2ban/filter.d/slapd.conf create mode 100644 fail2ban/filter.d/zoneminder.conf create mode 100644 fail2ban/jail.d/defaults-debian.conf create mode 100644 fail2ban/paths-arch.conf create mode 100644 logrotate.d/fail2ban create mode 100644 monit/monitrc.d/fail2ban create mode 120000 rc0.d/K01fail2ban create mode 120000 rc1.d/K01fail2ban create mode 120000 rc2.d/S05fail2ban create mode 120000 rc3.d/S05fail2ban create mode 120000 rc4.d/S05fail2ban create mode 120000 rc5.d/S05fail2ban create mode 120000 rc6.d/K01fail2ban create mode 120000 systemd/system/multi-user.target.wants/fail2ban.service diff --git a/.etckeeper b/.etckeeper index 529c3f5c..498ab7f3 100755 --- a/.etckeeper +++ b/.etckeeper @@ -22,7 +22,6 @@ mkdir -p './davfs2/certs/private' mkdir -p './dbus-1/session.d' mkdir -p './dhcp/ddns-keys' mkdir -p './fail2ban/fail2ban.d' -mkdir -p './fail2ban/jail.d' mkdir -p './glvnd/egl_vendor.d' mkdir -p './guest-session' mkdir -p './icinga/modules' @@ -44,6 +43,7 @@ mkdir -p './letsencrypt/renewal-hooks/deploy' mkdir -p './letsencrypt/renewal-hooks/post' mkdir -p './letsencrypt/renewal-hooks/pre' mkdir -p './libpaper.d' +mkdir -p './monit/conf-available' mkdir -p './mono/certstore' mkdir -p './mysql/mariadb.conf.d' mkdir -p './netplan' @@ -1152,6 +1152,7 @@ maybe chmod 0644 'bash_completion.d/axi-cache' maybe chmod 0644 'bash_completion.d/desktop-file-validate' maybe chmod 0644 'bash_completion.d/dkms' maybe chmod 0644 'bash_completion.d/docker' +maybe chmod 0644 'bash_completion.d/fail2ban' maybe chmod 0644 'bash_completion.d/gem1.9.1' maybe chmod 0644 'bash_completion.d/git-prompt' maybe chmod 0644 'bash_completion.d/grub' @@ -2157,6 +2158,7 @@ maybe chmod 0644 'default/devolo-updates' maybe chmod 0644 'default/devpts' maybe chmod 0644 'default/docker' maybe chmod 0644 'default/dovecot' +maybe chmod 0644 'default/fail2ban' maybe chmod 0644 'default/fetchmail' maybe chmod 0644 'default/grub' maybe chmod 0755 'default/grub.d' @@ -2371,6 +2373,7 @@ maybe chmod 0755 'etckeeper/vcs.d' maybe chmod 0755 'etckeeper/vcs.d/50vcs-cmd' maybe chmod 0755 'fail2ban' maybe chmod 0755 'fail2ban/action.d' +maybe chmod 0644 'fail2ban/action.d/abuseipdb.conf' maybe chmod 0664 'fail2ban/action.d/apf.conf' maybe chmod 0664 'fail2ban/action.d/badips.conf' maybe chmod 0664 'fail2ban/action.d/badips.py' @@ -2381,9 +2384,13 @@ maybe chmod 0664 'fail2ban/action.d/complain.conf' maybe chmod 0664 'fail2ban/action.d/dshield.conf' maybe chmod 0664 'fail2ban/action.d/dummy.conf' maybe chmod 0664 'fail2ban/action.d/firewallcmd-allports.conf' +maybe chmod 0644 'fail2ban/action.d/firewallcmd-common.conf' maybe chmod 0664 'fail2ban/action.d/firewallcmd-ipset.conf' maybe chmod 0664 'fail2ban/action.d/firewallcmd-multiport.conf' maybe chmod 0664 'fail2ban/action.d/firewallcmd-new.conf' +maybe chmod 0644 'fail2ban/action.d/firewallcmd-rich-logging.conf' +maybe chmod 0644 'fail2ban/action.d/firewallcmd-rich-rules.conf' +maybe chmod 0644 'fail2ban/action.d/helpers-common.conf' maybe chmod 0664 'fail2ban/action.d/hostsdeny.conf' maybe chmod 0664 'fail2ban/action.d/ipfilter.conf' maybe chmod 0664 'fail2ban/action.d/ipfw.conf' @@ -2403,9 +2410,12 @@ maybe chmod 0664 'fail2ban/action.d/mail-whois-lines.conf' maybe chmod 0664 'fail2ban/action.d/mail-whois.conf' maybe chmod 0664 'fail2ban/action.d/mail.conf' maybe chmod 0664 'fail2ban/action.d/mynetwatchman.conf' +maybe chmod 0644 'fail2ban/action.d/netscaler.conf' maybe chmod 0664 'fail2ban/action.d/nftables-allports.conf' maybe chmod 0664 'fail2ban/action.d/nftables-common.conf' maybe chmod 0664 'fail2ban/action.d/nftables-multiport.conf' +maybe chmod 0644 'fail2ban/action.d/nginx-block-map.conf' +maybe chmod 0644 'fail2ban/action.d/npf.conf' maybe chmod 0664 'fail2ban/action.d/nsupdate.conf' maybe chmod 0664 'fail2ban/action.d/osx-afctl.conf' maybe chmod 0664 'fail2ban/action.d/osx-ipfw.conf' @@ -2450,6 +2460,7 @@ maybe chmod 0664 'fail2ban/filter.d/courier-auth.conf' maybe chmod 0664 'fail2ban/filter.d/courier-smtp.conf' maybe chmod 0664 'fail2ban/filter.d/cyrus-imap.conf' maybe chmod 0664 'fail2ban/filter.d/directadmin.conf' +maybe chmod 0644 'fail2ban/filter.d/domino-smtp.conf' maybe chmod 0664 'fail2ban/filter.d/dovecot.conf' maybe chmod 0664 'fail2ban/filter.d/dropbear.conf' maybe chmod 0664 'fail2ban/filter.d/drupal-auth.conf' @@ -2468,6 +2479,7 @@ maybe chmod 0755 'fail2ban/filter.d/ignorecommands' maybe chmod 0775 'fail2ban/filter.d/ignorecommands/apache-fakegooglebot' maybe chmod 0664 'fail2ban/filter.d/kerio.conf' maybe chmod 0664 'fail2ban/filter.d/lighttpd-auth.conf' +maybe chmod 0644 'fail2ban/filter.d/mongodb-auth.conf' maybe chmod 0664 'fail2ban/filter.d/monit.conf' maybe chmod 0664 'fail2ban/filter.d/murmur.conf' maybe chmod 0664 'fail2ban/filter.d/mysqld-auth.conf' @@ -2484,6 +2496,7 @@ maybe chmod 0664 'fail2ban/filter.d/oracleims.conf' maybe chmod 0664 'fail2ban/filter.d/pam-generic.conf' maybe chmod 0664 'fail2ban/filter.d/perdition.conf' maybe chmod 0664 'fail2ban/filter.d/php-url-fopen.conf' +maybe chmod 0644 'fail2ban/filter.d/phpmyadmin-syslog.conf' maybe chmod 0664 'fail2ban/filter.d/portsentry.conf' maybe chmod 0664 'fail2ban/filter.d/postfix-rbl.conf' maybe chmod 0664 'fail2ban/filter.d/postfix-sasl.conf' @@ -2499,6 +2512,7 @@ maybe chmod 0664 'fail2ban/filter.d/selinux-ssh.conf' maybe chmod 0664 'fail2ban/filter.d/sendmail-auth.conf' maybe chmod 0664 'fail2ban/filter.d/sendmail-reject.conf' maybe chmod 0664 'fail2ban/filter.d/sieve.conf' +maybe chmod 0644 'fail2ban/filter.d/slapd.conf' maybe chmod 0664 'fail2ban/filter.d/sogo-auth.conf' maybe chmod 0664 'fail2ban/filter.d/solid-pop3d.conf' maybe chmod 0664 'fail2ban/filter.d/squid.conf' @@ -2513,9 +2527,12 @@ maybe chmod 0664 'fail2ban/filter.d/vsftpd.conf' maybe chmod 0664 'fail2ban/filter.d/webmin-auth.conf' maybe chmod 0664 'fail2ban/filter.d/wuftpd.conf' maybe chmod 0664 'fail2ban/filter.d/xinetd-fail.conf' +maybe chmod 0644 'fail2ban/filter.d/zoneminder.conf' maybe chmod 0664 'fail2ban/jail.conf' maybe chmod 0755 'fail2ban/jail.d' +maybe chmod 0644 'fail2ban/jail.d/defaults-debian.conf' maybe chmod 0644 'fail2ban/jail.local' +maybe chmod 0644 'fail2ban/paths-arch.conf' maybe chmod 0664 'fail2ban/paths-common.conf' maybe chmod 0664 'fail2ban/paths-debian.conf' maybe chmod 0664 'fail2ban/paths-fedora.conf' @@ -5903,6 +5920,7 @@ maybe chmod 0644 'logrotate.d/consolekit' maybe chmod 0644 'logrotate.d/cups-daemon' maybe chmod 0644 'logrotate.d/dbconfig-common' maybe chmod 0644 'logrotate.d/dpkg' +maybe chmod 0644 'logrotate.d/fail2ban' maybe chmod 0644 'logrotate.d/homematic' maybe chmod 0644 'logrotate.d/iptraf' maybe chmod 0644 'logrotate.d/iptraf-ng' @@ -5987,6 +6005,10 @@ maybe chmod 0644 'modprobe.d/vmwgfx-fbdev.conf' maybe chmod 0644 'modules' maybe chmod 0755 'modules-load.d' maybe chmod 0644 'modules-load.d/cups-filters.conf' +maybe chmod 0755 'monit' +maybe chmod 0755 'monit/conf-available' +maybe chmod 0755 'monit/monitrc.d' +maybe chmod 0644 'monit/monitrc.d/fail2ban' maybe chmod 0755 'mono' maybe chmod 0755 'mono/2.0' maybe chmod 0755 'mono/2.0/Browsers' diff --git a/bash_completion.d/fail2ban b/bash_completion.d/fail2ban new file mode 100644 index 00000000..b8887001 --- /dev/null +++ b/bash_completion.d/fail2ban @@ -0,0 +1,182 @@ +# fail2ban bash-completion -*- shell-script -*- +# +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +__fail2ban_jails () { + "$1" status 2>/dev/null | awk -F"\t+" '/Jail list/{print $2}' | sed 's/, / /g' +} +__fail2ban_jail_actions () { + "$1" get "$2" actions 2>/dev/null | sed -n '$s/\([^,]\+\),\?/\1/gp' +} +__fail2ban_jail_action_properties () { + "$1" get "$2" actionproperties "$3" 2>/dev/null | sed -n '$s/\([^,]\+\),\?/\1/gp' +} +__fail2ban_jail_action_methods () { + "$1" get "$2" actionmethods "$3" 2>/dev/null | sed -n '$s/\([^,]\+\),\?/\1/gp' +} + +_fail2ban () { + local cur prev words cword + _init_completion || return + + case $prev in + -V|--version|-h|--help) + return 0 # No further completion valid + ;; + -c) + _filedir -d # Directories + return 0 + ;; + -s|-p) + _filedir # Files + return 0 + ;; + *) + if [[ "$cur" == "-"* ]];then + COMPREPLY=( $( compgen -W \ + "$( _parse_help "$1" --help 2>/dev/null) -V" \ + -- "$cur") ) + return 0 + fi + ;; + esac + + if [[ "$1" == *"fail2ban-regex" ]];then + _filedir + return 0 + elif [[ "$1" == *"fail2ban-client" ]];then + local cmd jail action + case $prev in + "$1") + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ [a-z]+/{print $1}')" \ + -- "$cur") ) + return 0 + ;; + start|reload|stop|status) + COMPREPLY=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) ) + return 0 + ;; + set|get) + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ '$prev' [^<]/{print $2}')" \ + -- "$cur") ) + COMPREPLY+=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) ) + return 0 + ;; + *) + if [[ "${words[$cword-2]}" == "add" ]];then + COMPREPLY=( $( compgen -W "auto polling gamin pyinotify systemd" -- "$cur" ) ) + return 0 + elif [[ "${words[$cword-2]}" == "set" || "${words[$cword-2]}" == "get" ]];then + cmd="${words[cword-2]}" + # Handle in section below + elif [[ "${words[$cword-3]}" == "set" || "${words[$cword-3]}" == "get" ]];then + cmd="${words[$cword-3]}" + jail="${words[$cword-2]}" + # Handle in section below + elif [[ "${words[$cword-4]}" == "set" || "${words[$cword-4]}" == "get" && ${words[$cword-2]} == action* ]];then + cmd="${words[$cword-4]}" + jail="${words[$cword-3]}" + action="${words[$cword-1]}" + # Handle in section below + fi + ;; + esac + + if [[ -z "$jail" && -n "$cmd" ]];then + case $prev in + loglevel) + if [[ "$cmd" == "set" ]];then + COMPREPLY=( $( compgen -W "CRITICAL ERROR WARNING NOTICE INFO DEBUG" -- "$cur" ) ) + fi + return 0 + ;; + logtarget) + if [[ "$cmd" == "set" ]];then + COMPREPLY=( $( compgen -W "STDOUT STDERR SYSLOG SYSOUT" -- "$cur" ) ) + _filedir # And files + fi + return 0 + ;; + *) # Jail name + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ '${cmd}' /{print $3}')" \ + -- "$cur") ) + return 0 + ;; + esac + elif [[ -n "$jail" && -n "$action" ]];then + case ${words[$cwords-3]} in + action) + COMPREPLY=( $( compgen -W \ + "$( __fail2ban_jail_action_properties "$1" "$jail" "$action")" \ + -- "$cur" ) ) + if [[ "$cmd" == "set" ]];then + COMPREPLY+=( $(compgen -W "$(__fail2ban_jail_action_methods "$1" "$jail" "$action")" -- "$cur" ) ) + fi + return 0 + ;; + esac + elif [[ -n "$jail" && $prev == action* ]];then + case $prev in + action|actionproperties|actionmethods) + COMPREPLY=( $(compgen -W "$(__fail2ban_jail_actions "$1" "$jail")" -- "$cur" ) ) + return 0 + ;; + esac + elif [[ -n "$jail" && "$cmd" == "set" ]];then + case $prev in + addlogpath) + _filedir + return 0 + ;; + dellogpath|delignoreip) + COMPREPLY=( $( compgen -W \ + "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F- '{print $2}')" \ + -- "$cur" ) ) + if [[ -z "$COMPREPLY" && "$prev" == "dellogpath" ]];then + _filedir + fi + return 0 + ;; + delfailregex|delignoreregex) + COMPREPLY=( $( compgen -W \ + "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F"[][]" '{print $2}')" \ + -- "$cur" ) ) + return 0 + ;; + unbanip) + COMPREPLY=( $( compgen -W \ + "$( "$1" status "$jail" 2>/dev/null | awk -F"\t+" '/IP list:/{print $2}')" \ + -- "$cur" ) ) + return 0 + ;; + idle) + COMPREPLY=( $( compgen -W "on off" -- "$cur" ) ) + return 0 + ;; + usedns) + COMPREPLY=( $( compgen -W "yes no warn" -- "$cur" ) ) + return 0 + ;; + esac + fi + + fi # fail2ban-client +} && +complete -F _fail2ban fail2ban-client fail2ban-server fail2ban-regex diff --git a/default/fail2ban b/default/fail2ban new file mode 100644 index 00000000..35bb3771 --- /dev/null +++ b/default/fail2ban @@ -0,0 +1,39 @@ +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +# Author: Cyril Jaquier +# +# $Revision$ + +# Command line options for Fail2Ban. Refer to "fail2ban-client -h" for +# valid options. +FAIL2BAN_OPTS="" + +# Run fail2ban as a different user. If not set, fail2ban +# will run as root. +# +# The user is not created automatically. +# The user can be created e.g. with +# useradd --system --no-create-home --home-dir / --groups adm fail2ban +# Log files are readable by group adm by default. Adding the fail2ban +# user to this group allows it to read the logfiles. +# +# Another manual step that needs to be taken is to allow write access +# for fail2ban user to fail2ban log files. The /etc/init.d/fail2ban +# script will change the ownership when starting fail2ban. Logrotate +# needs to be configured separately, see /etc/logrotate.d/fail2ban. +# +# FAIL2BAN_USER="fail2ban" diff --git a/fail2ban/action.d/abuseipdb.conf b/fail2ban/action.d/abuseipdb.conf new file mode 100644 index 00000000..15e41fbe --- /dev/null +++ b/fail2ban/action.d/abuseipdb.conf @@ -0,0 +1,105 @@ +# Fail2ban configuration file +# +# Action to report IP address to abuseipdb.com +# You must sign up to obtain an API key from abuseipdb.com. +# +# NOTE: These reports may include sensitive Info. +# If you want cleaner reports that ensure no user data see the helper script at the below website. +# +# IMPORTANT: +# +# Reporting an IP of abuse is a serious complaint. Make sure that it is +# serious. Fail2ban developers and network owners recommend you only use this +# action for: +# * The recidive where the IP has been banned multiple times +# * Where maxretry has been set quite high, beyond the normal user typing +# password incorrectly. +# * For filters that have a low likelihood of receiving human errors +# +# This action relies on a api_key being added to the above action conf, +# and the appropriate categories set. +# +# Example, for ssh bruteforce (in section [sshd] of `jail.local`): +# action = %(known/action)s +# %(action_abuseipdb)s[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"] +# +# See below for catagories. +# +# Original Ref: https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban +# Added to fail2ban by Andrew James Collett (ajcollett) + +## abuseIPDB Catagories, `the abuseipdb_category` MUST be set in the jail.conf action call. +# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"] +# ID Title Description +# 3 Fraud Orders +# 4 DDoS Attack +# 9 Open Proxy +# 10 Web Spam +# 11 Email Spam +# 14 Port Scan +# 18 Brute-Force +# 19 Bad Web Bot +# 20 Exploited Host +# 21 Web App Attack +# 22 SSH Secure Shell (SSH) abuse. Use this category in combination with more specific categories. +# 23 IoT Targeted +# See https://abuseipdb.com/categories for more descriptions + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# +# ** IMPORTANT! ** +# +# By default, this posts directly to AbuseIPDB's API, unfortunately +# this results in a lot of backslashes/escapes appearing in the +# reports. This also may include info like your hostname. +# If you have your own web server with PHP available, you can +# use my (Shaun's) helper PHP script by commenting out the first #actionban +# line below, uncommenting the second one, and pointing the URL at +# wherever you install the helper script. For the PHP helper script, see +# +# +# --ciphers ecdhe_ecdsa_aes_256_sha is used to workaround a +# "NSS error -12286" from curl as it attempts to connect using +# SSLv3. See https://www.centos.org/forums/viewtopic.php?t=52732 +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = curl --fail --ciphers ecdhe_ecdsa_aes_256_sha --data 'key=' --data-urlencode 'comment=' --data 'ip=' --data 'category=' "https://www.abuseipdb.com/report/json" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +[Init] +# Option: abuseipdb_apikey +# Notes Your API key from abuseipdb.com +# Values: STRING Default: None +# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. +# You will need to set the catagory in the action call. +abuseipdb_apikey = diff --git a/fail2ban/action.d/badips.py b/fail2ban/action.d/badips.py index 025289ca..473fbf33 100644 --- a/fail2ban/action.d/badips.py +++ b/fail2ban/action.d/badips.py @@ -34,7 +34,7 @@ else: from fail2ban.server.actions import ActionBase -class BadIPsAction(ActionBase): +class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable """Fail2Ban action which reports bans to badips.com, and also blacklist bad IPs listed on badips.com by using another action's ban method. @@ -80,14 +80,17 @@ class BadIPsAction(ActionBase): If invalid `category`, `score`, `banaction` or `updateperiod`. """ + TIMEOUT = 10 _badips = "http://www.badips.com" def _Request(self, url, **argv): return Request(url, headers={'User-Agent': self.agent}, **argv) def __init__(self, jail, name, category, score=3, age="24h", key=None, - banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban"): + banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban", + timeout=TIMEOUT): super(BadIPsAction, self).__init__(jail, name) + self.timeout = timeout self.agent = agent self.category = category self.score = score @@ -102,6 +105,16 @@ class BadIPsAction(ActionBase): # Used later for threading.Timer for updating badips self._timer = None + @staticmethod + def isAvailable(timeout=1): + try: + response = urlopen(Request("/".join([BadIPsAction._badips]), + headers={'User-Agent': "Fail2Ban"}), timeout=timeout) + return True, '' + except Exception as e: # pragma: no cover + return False, e + + def getCategories(self, incParents=False): """Get badips.com categories. @@ -119,7 +132,7 @@ class BadIPsAction(ActionBase): """ try: response = urlopen( - self._Request("/".join([self._badips, "get", "categories"])), None, 3) + self._Request("/".join([self._badips, "get", "categories"])), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( @@ -173,7 +186,7 @@ class BadIPsAction(ActionBase): urlencode({'age': age})]) if key: url = "&".join([url, urlencode({'key': key})]) - response = urlopen(self._Request(url)) + response = urlopen(self._Request(url), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( @@ -358,7 +371,7 @@ class BadIPsAction(ActionBase): url = "/".join([self._badips, "add", self.category, aInfo['ip']]) if self.key: url = "?".join([url, urlencode({'key': self.key})]) - response = urlopen(self._Request(url)) + response = urlopen(self._Request(url), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( diff --git a/fail2ban/action.d/bsd-ipfw.conf b/fail2ban/action.d/bsd-ipfw.conf index 8b0a51aa..cbd6a15d 100644 --- a/fail2ban/action.d/bsd-ipfw.conf +++ b/fail2ban/action.d/bsd-ipfw.conf @@ -14,7 +14,7 @@ # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = ipfw show | fgrep -q 'table()' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) +actionstart = ipfw show | fgrep -c -m 1 -s 'table(
)' > /dev/null 2>&1 || ( ipfw show | awk 'BEGIN { b = } { if ($1 < b) {} else if ($1 == b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) # Option: actionstop @@ -81,3 +81,11 @@ block = ip # Values: STRING # blocktype = unreach port + +# Option: lowest_rule_num +# Notes: When fail2ban starts with action and there is no rule for the given table yet +# then fail2ban will start looking for an empty slot starting with this rule number. +# Values: NUM +lowest_rule_num = 111 + + diff --git a/fail2ban/action.d/cloudflare.conf b/fail2ban/action.d/cloudflare.conf index aa87163c..89df5b9e 100644 --- a/fail2ban/action.d/cloudflare.conf +++ b/fail2ban/action.d/cloudflare.conf @@ -40,7 +40,12 @@ actioncheck = #